CVE-2023-32321

CKAN (open-source data management system) is affected by CVE-2023-32321 with multiple flaws in older CKAN releases up to 2.9.9/2.10.1. The issues include: (1) arbitrary file writes in resource_create and package_update via ResourceUploader, potentially reachable through package_create/revise/patc...

CVE-2023-32321 CKAN remote code execution and private information access via crafted resource ids

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

CKAN 安全漏洞

CKAN is an open source Dms data management system. It is used to power data centers and data portals. A security vulnerability exists in CKAN versions prior to 2.9.9, and prior to 2.10.1, which stems from DOS due to a lack of length checking for resource ids...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS bas...

CVE-2023-30855

Pimcore Path Traversal (CVE-2023-30855) affects Pimcore versions before 10.5.18, specifically in AdminBundle/Controller/Reports/CustomReportController.php. The vulnerability allows path traversal and arbitrary file creation/append operations; when combined with SQL Injection, it can expose or rea...

Path traversal

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the /admin/misc/script-proxy API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the scriptPath and scripts parameters. The...

CVE-2023-30852 Pimcore Arbitrary File Read in Admin JS CSS files

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the /admin/misc/script-proxy API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the scriptPath and scripts parameters. The...

CVE-2023-30852

Pimcore prior to 10.5.21 exposes an Arbitrary File Read via the authenticated admin endpoint /admin/misc/script-proxy. The vulnerability stems from improper sanitization of the scriptPath parameter, enabling path traversal with multiple ../ patterns to read JavaScript/CSS files from the server wh...

CVE-2023-30848

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually...

Sql injection

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually...

CVE-2023-30850

CVE-2023-30850 affects Pimcore prior to 10.5.21, where the admin translations API is vulnerable to SQL injection. The issue arises in the API endpoint that accepts a JSON-encoded filter parameter (not sanitized properly), enabling an attacker with admin access to inject SQL. A patch is available ...

CVE-2023-30849

Pimcore

CVE-2023-30848

Pimcore’s Admin Search Find API is vulnerable to blind SQL injection due to an incomplete fix for CVE-2023-30848. The patch only removed SQL comments and caught syntax errors, while attacker-controlled fields[] remain used in SQL query construction, enabling payloads that infer data without trigg...

Getting started with the CDMC framework—Microsoft’s guide to cloud data management

On March 20, 2023, Microsoft announced the successful completion of the Cloud Data Management Capabilities CDMC certification. As a proponent of wider industry standards, I was fortunate to be part of Microsoft’s executive team working to achieve this important milestone. Beginning in 2020, we...

Getting started with the CDMC framework—Microsoft’s guide to cloud data management

On March 20, 2023, Microsoft announced the successful completion of the Cloud Data Management Capabilities CDMC certification. As a proponent of wider industry standards, I was fortunate to be part of Microsoft’s executive team working to achieve this important milestone. Beginning in 2020, we...

Nokia OneNDS 权限许可和访问控制问题漏洞

Nokia OneNDS is a web directory server from Nokia, Finland. It is a core element of the Subscriber Data Management SDM solution. A vulnerability in Nokia OneNDS 17r2 exists in the form of a privilege permission and access control issue vulnerability that stems from incorrect privilege management...

Unspecified Vulnerability in Oracle Database Server (CNVD-2023-71321)

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. A security vulnerability exists in Oracle Database Server version 19c, version 21c. An...

Nokia OneNDS 权限许可和访问控制问题漏洞

Nokia OneNDS is a web directory server from Nokia, Finland. It is a core element of the Subscriber Data Management SDM solution. A privilege permission and access control issue vulnerability exists in Nokia OneNDS version 20.9, which stems from an error in the security configuration and can be...

Protect intellectual property with Govern 365 and Microsoft Purview

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Global supply chains face a broad range of risks, from physical threats to cybersecurity threats. Sharing information with suppliers is essential for the supply chain to function...

Best practices regarding Azure Storage Keys, Azure Functions, and Azure Role Based Access

Summary Azure provides developers and security operations staff a wide array of configurable security options to meet organizational needs. Throughout the software development lifecycle, it is important for customers to understand the shared responsibility model, as well as be familiar with vario...